This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSec VPN default gateway not working

Sophos XG210

I have two IP addresses configured on my WAN port as VLAN's. Currently all my traffic including an SSL VPN setup is configured on one of those IP addresses.

I would like to set up an IPSec connection on my spare IP so I can take advantage of forcing clients to automatically connect.

I have ran through the setup guide and kind of got it working but my test laptop will not connect to the internet when I select 'Use a default gateway' but it can see local resources.

When I uncheck the use default gateway option it connects to the internet and onsite resources. But I want the client to use the default gateway so it has the company IP address.

Any idea what I am doing wrong?

This thread was automatically locked due to age.

Top Replies

Downsideup over 2 years ago in reply to Vishal_R +1

Great, thanks Vishel. I think this is the issue! I will have a look at this out of office hours and let you know if it resolves my issue. As I have two WAN IP's (x.x.x.1 and x.x.x.2) on the same interface…

Parents

0 Vishal_R over 2 years ago

Hi Downsideup : Thank you for reaching out to the Sophos community team. Option 'Use a default gateway' route internet traffic of end machine to XG and in this scenario you may required VPN to WAN firewall rule and NAT rule to NAT/MASQ outgoing traffic to WAN ( which is coming from VPN).

Can you please confirm these required rules are present on your XG?

If yes it is present and still issue there then please share TCPDUMP and drop packet output from XG for any public IP on which you are checking PING for testing internet after connecting IPsec (remote access).

TCPDUMP command

a) console>tcpdump 'host x.x.x.x

KBA : https://support.sophos.com/support/s/article/KB-000035939?language=en_US

Drop packet command:

b) console> drop 'host x.x.x.x

x.x.x.x is the reference public IP on which you are checking PING after connecting IPsec remote access.

Regards,

Vishal Ranpariya
Technical Account Manager | Sophos Technical Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Downsideup over 2 years ago in reply to Vishal_R

Hi Vishal, I have a VPN to WAN firewall rule but don't think I have a NAT\MASQ for the WAN ip address. How do I set it up?
Cancel
Vote Up 0 Vote Down

Cancel
0 Vishal_R over 2 years ago in reply to Downsideup

Hi Downsideup : Either you may create linked NAT rule during firewall rule creation time or you may create separate NAT rule by defining required settings/detailsas per below steps.

docs.sophos.com/.../CreatingSNATRule.html

V18 NAT : www.youtube.com/watch

Regards,

Vishal Ranpariya
Technical Account Manager | Sophos Technical Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Downsideup over 2 years ago in reply to Vishal_R

Great, thanks Vishel. I think this is the issue!

I will have a look at this out of office hours and let you know if it resolves my issue.

As I have two WAN IP's (x.x.x.1 and x.x.x.2) on the same interface and the IPSec has been set up on x.x.x.2, should I put my NAT on x.x.x.2 or can it be set to x.x.x.1 like my SSL VPN connection?
Cancel
Vote Up +1 Vote Down

Cancel

Reply

0 Downsideup over 2 years ago in reply to Vishal_R

Great, thanks Vishel. I think this is the issue!

I will have a look at this out of office hours and let you know if it resolves my issue.

As I have two WAN IP's (x.x.x.1 and x.x.x.2) on the same interface and the IPSec has been set up on x.x.x.2, should I put my NAT on x.x.x.2 or can it be set to x.x.x.1 like my SSL VPN connection?
Cancel
Vote Up +1 Vote Down

Cancel

Children

+1 Vishal_R over 2 years ago in reply to Downsideup

Hi Downsideup : Here your WAN or Internet traffic by default will be load balance by XG firewall between available active WAN gateway, so setting up NAT action MASQ is fine. MASQ will do NAT with exist interface IP address.

If traffic exists via WAN 1: NAT IP will be x.x.x.1 and if traffic exists via WAN 2: NAT IP will be x.x.x.2 with MASQ action.

Regards,

Vishal Ranpariya
Technical Account Manager | Sophos Technical Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up +1 Vote Down

Cancel
0 Downsideup over 2 years ago in reply to Vishal_R

Thanks, one other thing

How do I stop get an alert email every time my test client connects and disconnects the tunnel?
Cancel
Vote Up 0 Vote Down

Cancel
+1 FormerMember over 2 years ago in reply to Downsideup

Hi Downsideup,

You can turn off notifications for VPN connection from System services > Notification list.
Cancel
Vote Up +1 Vote Down

Cancel
0 Downsideup over 2 years ago in reply to FormerMember

Thanks, that worked, I should of found that myself
Cancel
Vote Up +1 Vote Down

Cancel